I'm trying to ignore specific fields within a syslog entry from being forwarded to Splunk. This can not be done on the host level so I was looking towards the props/transforms for help. Unfortunately, I can not figure this one out.
I have a single line log entry from a Juniper SRX:
That's a giant entry (I have lots of them!) and I'd like to eliminate specific fields that we have aren't interested in (i.e. "src-nat-rule-name="None") but keeping the rest of the log entry. Is this possible? I think specifying any field with regex will match (and null out) the entire line and that's not what I want. My files for reference:
I've done something similar to this. In transforms.conf you basically need to rewrite _raw with matching groups from your regex. So you'll write your regex so that some matching groups match what you want to keep, and others match what you want to discard. Then you append the matching groups you want to keep and apply them to _raw.